Listen to this Post
Introduction: When a Blockchain Becomes a Hidden Cyber Weapon
Cybersecurity defenders have spent years learning how to identify malicious command-and-control infrastructure. Suspicious domains, hard-coded IP addresses, unusual network connections, and attacker-controlled servers have traditionally provided valuable clues during malware investigations. But threat actors are constantly searching for ways to remove those clues—or hide them in places defenders are less likely to inspect.
A newly identified technique called NullReceiver demonstrates how far this evolution has progressed. Researchers discovered that malware linked to the Democratic People’s Republic of Korea (DPRK) was using ordinary Ethereum transactions as a public yet difficult-to-detect location for storing command-and-control (C2) information.
Instead of embedding a malicious server address directly inside malware code, the attackers concealed the C2 address inside the recipient field of a zero-value Ethereum transaction. To an ordinary blockchain observer, the transaction could look harmless: no funds were transferred, no smart contract was called, and no meaningful transaction payload was present. Yet the recipient address itself contained hidden information that the malware could decode during execution.
The technique was discovered in two trojanized npm packages impersonating legitimate Tailwind CSS-related plugins. The packages were associated with the DPRK-linked Contagious Interview campaign, a long-running operation known for targeting developers and technology professionals through fake recruitment opportunities, malicious coding assignments, and compromised software packages.
NullReceiver is more than another malware trick. It represents a broader shift in cyber operations: attackers are increasingly turning trusted public infrastructure into resilient components of their operational ecosystem. In this case, Ethereum is not being used to move cryptocurrency. It is being used as a decentralized, publicly accessible dead-drop system for malware.
Summary: A New Way to Hide Malware Infrastructure
Researchers identified NullReceiver in two malicious npm packages:
[email protected]
[email protected]
Both packages impersonated legitimate Tailwind CSS plugins and were connected to the DPRK-linked Contagious Interview campaign.
The malware did not contain a traditional hard-coded C2 domain or IP address. Instead, it contacted public Ethereum Remote Procedure Call (RPC) services, retrieved blockchain activity associated with an attacker-controlled wallet, and extracted the hidden C2 information from the recipient address of a transaction.
The observed Ethereum transaction had a value of zero and an empty input field:
{
value: 0x0,
input: 0x
}
The transaction therefore appeared to be an ordinary empty wallet-to-wallet transfer. However, its recipient address contained encoded information:
0xa658863ea658863e68656c6c6f6970626f742121
Part of the address decoded to the C2 IP address:
166.88.134.62
The remaining bytes decoded to the ASCII string:
helloipbot!!
This additional string may function as an operator marker, implementation fingerprint, validation value, or internal identifier associated with the malware infrastructure.
The technique appears to be an evolution of EtherHiding, another blockchain-based C2 method associated with DPRK activity. However, NullReceiver removes several detection opportunities that defenders previously relied upon, including smart-contract interactions, transaction calldata, and a fixed destination address.
The Trojanized npm Packages Behind the Campaign
Malicious Package: [email protected]
The package [email protected] was presented as a Tailwind CSS-related component, giving developers a plausible reason to install it. Modern development environments depend heavily on open-source packages, and attackers understand that familiar names, useful-looking descriptions, and realistic version numbers can reduce suspicion.
A malicious package does not need to be widely downloaded to be dangerous. A single successful installation inside a software company, cloud environment, startup, or developer workstation may provide attackers with access to source code, credentials, build systems, or internal infrastructure.
Malicious Package: [email protected]
The second package, [email protected], used the NullReceiver technique to obtain its command-and-control infrastructure dynamically.
By retrieving the C2 location after installation, the malware reduced the amount of directly suspicious information visible inside the package. Static scanners searching for malicious domains, known IP addresses, or suspicious URLs could potentially miss the real infrastructure because the malware did not store that information locally.
This design also gives attackers operational flexibility. They can change the C2 destination by publishing new blockchain transactions without necessarily modifying or republishing the malicious npm package.
How NullReceiver Hides Command-and-Control Infrastructure
Step One: The Malware Contains a Blockchain Lookup Routine
The malicious code includes logic that communicates with public Ethereum RPC endpoints. Researchers observed the malware using services such as:
1rpc.io
eth.drpc.org
These services provide access to Ethereum blockchain data. Because they are legitimate public infrastructure, network requests to them may not immediately appear malicious.
A defender who sees a workstation connecting to a public blockchain service may assume the activity is related to cryptocurrency development, decentralized applications, blockchain research, or ordinary developer experimentation. That ambiguity can help attackers blend into legitimate traffic.
Step Two: The Malware Identifies Attacker-Controlled Activity
The malware queries blockchain activity connected to an attacker-controlled Ethereum wallet.
Rather than contacting a private malicious server to request configuration data, the malware retrieves publicly available blockchain information. The blockchain acts as a distributed information repository that is accessible from many locations.
This creates a major operational advantage: the attacker does not need to maintain a traditional C2 server solely for distributing the initial destination.
Step Three: A Zero-Value Transaction Appears
The malware retrieves a transaction with no financial value:
{
value: 0x0
}
The transaction also contains an empty input field:
{
input: 0x
}
There is no smart-contract call and no visible transaction payload containing a malicious URL or script.
For many automated systems, this may appear to be a meaningless blockchain transaction.
Step Four: The Recipient Address Becomes a Data Container
The hidden information is stored inside the transaction’s recipient—or to—address.
The observed address was:
0xa658863ea658863e68656c6c6f6970626f742121
Ethereum addresses are normally interpreted as identifiers representing destinations for transactions. NullReceiver repurposes the address as a container for encoded data.
The address is not important because it receives funds. It is important because its hexadecimal bytes contain information that the malware can decode.
Step Five: The Malware Reconstructs the C2 Address
The encoded bytes reveal the C2 IP address:
166.88.134.62
The remaining bytes reveal:
helloipbot!!
The malware can then use the recovered C2 address to continue communication with attacker-controlled infrastructure.
The blockchain transaction therefore functions like a public dead drop. Anyone can view it, but its operational meaning remains hidden unless an analyst understands which wallet to investigate and how the malware interprets the recipient address.
Why NullReceiver Is Harder to Detect
No Hard-Coded C2 Address
Traditional malware often stores a domain name or IP address directly in its source code or binary.
Security products can search for these indicators using static analysis, threat intelligence feeds, reputation systems, or pattern matching.
NullReceiver avoids exposing the real C2 destination until runtime. The malware retrieves it from the blockchain only after execution.
No Smart Contract Interaction
Many blockchain-based malware investigations focus on suspicious smart-contract activity.
Smart contracts can store scripts, URLs, configuration data, or other content. Their use may create recognizable patterns that security researchers can monitor.
NullReceiver does not rely on a smart contract. This removes one of the most obvious blockchain-related signals.
No Transaction Calldata
Ethereum transaction calldata can contain arbitrary information.
Earlier techniques such as EtherHiding used transaction input data to store malicious content. Analysts could inspect the calldata and search for suspicious URLs, scripts, or encoded payloads.
NullReceiver avoids this approach entirely.
The transaction input field is simply:
0x
This makes the transaction appear empty.
No Fixed Destination Address
EtherHiding commonly used Ethereum’s well-known burn address:
0x000000000000000000000000000000000000dEaD
Because the destination was fixed and publicly recognizable, defenders could monitor transactions involving that address.
NullReceiver removes this detection advantage.
Instead of using a permanent destination, the attackers can generate new recipient addresses that appear random. The hidden C2 data is embedded inside those addresses.
This forces defenders to begin their investigation from the attacker-controlled wallet or the malware’s decoding logic rather than from a known destination.
NullReceiver and EtherHiding: A Critical Evolution
EtherHiding Uses Visible Blockchain Features
EtherHiding stores malicious information inside Ethereum transaction calldata.
This allows attackers to store larger amounts of information, including scripts, complete URLs, and more complex configuration data.
However, the technique creates several observable signals:
Smart-contract or specialized transaction behavior may be visible.
Transaction calldata is not empty.
A known destination address may be monitored.
The stored content may be extracted and analyzed.
These characteristics provide defenders with multiple investigation paths.
NullReceiver Reduces the Number of Observable Clues
NullReceiver stores only a short value inside the recipient address.
It sacrifices payload size in exchange for stealth.
The technique is optimized for delivering a compact C2 location rather than large scripts or complete malware components.
This design reflects a common pattern in modern offensive development: attackers do not always need to hide everything. They only need to hide the smallest critical piece required to reach the next stage.
A Smaller Payload Can Create a Larger Detection Problem
The recipient address has limited space, but an IP address is small enough to fit within the available bytes.
That is sufficient for the malware to discover where to connect next.
Once the malware reaches its external C2 infrastructure, the attackers may deliver additional instructions, payloads, or updates through more traditional channels.
The blockchain therefore serves as an initial locator rather than a complete malware hosting platform.
Deep Analysis: Hunting NullReceiver in Code and Network Activity
Static Analysis: Search for the Identified Signature
Researchers identified the string:
A10-npm3!
as a possible detection signature associated with related code.
Security teams can search npm package caches, source repositories, build environments, endpoint file systems, and software artifacts for the value.
Example Linux command:
grep -RIn --binary-files=without-match \n"A10-npm3!" \n/path/to/npm/projects
Example search across a user’s npm cache:
grep -RIn \n"A10-npm3!" \n~/.npm 2>/dev/null
A match should not automatically be treated as proof of compromise. Analysts should examine the surrounding code, package metadata, installation history, and execution behavior.
Package Inspection: Identify Suspicious Dependencies
Developers can review installed packages with:
npm list --all
To inspect a specific package:
npm view [email protected] npm view [email protected]
To examine package contents without executing installation scripts:
npm pack [email protected] npm pack [email protected]
After extracting the archive, analysts can search for suspicious Ethereum-related code:
tar -xf bianira-ui-1.27.0.tgz grep -RInE \n"eth_getTransaction|eth_getBlockByNumber|1rpc|drpc|A10-npm3!" \npackage/ Network Hunting: Identify Unexpected Ethereum RPC Requests
Organizations should review whether developer systems are expected to contact Ethereum RPC services.
Example proxy or DNS hunt concepts:
domain IN (
1rpc.io,
eth.drpc.org
)
Example command-line search through proxy logs:
grep -Ei \n"1rpc.io|eth.drpc.org|ethereum" \n/var/log/proxy/access.log
Unexpected blockchain traffic from build servers, CI/CD runners, application servers, or developer workstations should be investigated in context.
Blockchain RPC traffic is not inherently malicious. The key question is whether the activity matches legitimate business or development requirements.
Behavioral Analysis: Look for Runtime C2 Resolution
Analysts should monitor processes that:
Node.js process
↓
Public Ethereum RPC endpoint
↓
Blockchain transaction lookup
↓
Recipient address extraction
↓
Hex decoding
↓
Outbound connection to recovered IP
This sequence is far more suspicious than any single event.
A connection to an Ethereum RPC endpoint may be legitimate. A Node.js process that retrieves transaction information, decodes an address into an IP address, and immediately connects to that IP is a much stronger behavioral signal.
Example Detection Logic
A conceptual detection rule could focus on the following sequence:
IF
node.exe OR node
contacts an Ethereum RPC service
AND
the process performs blockchain transaction queries
AND
the process converts hexadecimal address data
into an IPv4 address
AND
the process establishes a new external connection
THEN
raise a high-priority investigation alert
This is not a complete production detection rule. Organizations should adapt the logic to their endpoint telemetry, proxy infrastructure, SIEM, and EDR platform.
YARA-Style Hunting Example
The following example is intended for threat hunting and should be validated before production deployment:
rule Possible_NullReceiver_NPM_Code
{
meta:
description = "Hunts for possible NullReceiver-related npm code" author = "Undercode Security Research" date = "2026-08-04"
strings:
$signature = A10-npm3!
$rpc1 = 1rpc.io
$rpc2 = eth.drpc.org
$eth1 = eth_getTransactionByHash
$eth2 = eth_getBlockByNumber
condition:
$signature or
(
1 of ($rpc) and
1 of ($eth)
)
}
The rule should be treated as a starting point rather than a definitive malware classifier.
The Contagious Interview Connection
Fake Recruitment as an Initial Access Method
The Contagious Interview campaign has repeatedly used employment-themed social engineering to target developers.
Attackers may impersonate recruiters, technology companies, or hiring managers. Victims can be asked to complete coding assignments, test projects, install dependencies, or review software repositories.
The malicious component may be presented as a normal development requirement.
This approach exploits professional trust. Developers are accustomed to downloading packages, reviewing repositories, and executing unfamiliar code during technical interviews.
Why Developers Remain High-Value Targets
A developer workstation may contain:
Source code
Cloud credentials
API keys
SSH keys
npm authentication tokens
CI/CD credentials
Internal repository access
Production deployment permissions
Compromising one developer may provide a path into an entire software supply chain.
The attack therefore targets more than an individual device. It may target the organization’s development ecosystem.
What Undercode Say:
The Blockchain Is Becoming a Cyber Operations Layer
NullReceiver shows that public blockchains can be repurposed as operational infrastructure rather than financial technology.
Ethereum’s transparency does not automatically make malicious activity easy to detect.
The data is public, but its meaning can remain hidden.
Attackers are exploiting the difference between visibility and interpretation.
A blockchain transaction may be available to everyone while still appearing harmless.
The challenge is no longer simply collecting blockchain data.
The challenge is understanding how malware interprets it.
Traditional C2 Blocking Is Losing Visibility
Security teams often block malicious domains and IP addresses.
NullReceiver delays the discovery of the C2 destination.
The malware can obtain the destination dynamically.
A static blocklist may not contain the address before execution.
This weakens traditional indicator-based detection.
Behavioral analysis becomes more important.
Public Infrastructure Creates Resilience
Attackers benefit from infrastructure that is difficult to remove.
A centralized malicious server can be seized or shut down.
A blockchain transaction is distributed across many nodes.
The attacker does not need to operate the blockchain.
They only need to publish information to it.
This reduces infrastructure maintenance.
It also complicates disruption efforts.
The Technique Uses Legitimate Services as Cover
Public Ethereum RPC services are legitimate.
Blocking them globally may disrupt real development activity.
That creates a difficult defensive trade-off.
Organizations must distinguish expected blockchain use from suspicious use.
Context becomes more valuable than reputation alone.
Zero-Value Transactions Are Not Automatically Harmless
A transaction with no financial value may appear irrelevant.
NullReceiver demonstrates that metadata can carry operational meaning.
The recipient address becomes a covert storage field.
The transaction is not important for its financial function.
It is important for its encoded structure.
The Recipient Field Has Become a Hidden Message Channel
Ethereum addresses are usually treated as destinations.
NullReceiver treats them as data.
This is a simple but powerful conceptual shift.
The attackers are using a required transaction field as a covert container.
The data is hidden in plain sight.
Detection Must Move Beyond Known Wallet Addresses
Monitoring known malicious wallets remains useful.
However, attackers can rotate wallets.
They can also generate new recipient addresses.
Defenders should identify decoding behavior.
They should monitor suspicious transaction retrieval.
They should correlate blockchain access with follow-on network activity.
Software Supply Chains Remain a Strategic Target
The npm ecosystem provides enormous value to developers.
Its scale also creates opportunities for abuse.
A package may look trustworthy because of its name.
A realistic version number can increase credibility.
A familiar framework reference can reduce suspicion.
Package identity must be verified independently.
Dependency Names Are Not Security Guarantees
A package that resembles a popular plugin may still be malicious.
Developers should verify publishers.
They should review package history.
They should inspect dependency trees.
They should avoid installing unverified packages during interviews.
Runtime Analysis Is Becoming Essential
Static scanning may not reveal the final C2 address.
The address is reconstructed after execution.
Sandbox systems should capture blockchain requests.
They should inspect decoded values.
They should observe subsequent network connections.
Runtime behavior may reveal what static code hides.
Security Teams Need Blockchain-Aware Telemetry
Traditional network monitoring may not parse Ethereum RPC traffic.
Security platforms may record the connection without understanding the query.
Organizations should consider enriching blockchain-related logs.
Wallet identifiers can become investigation pivots.
Transaction hashes may become threat intelligence indicators.
Recipient-address patterns may reveal hidden infrastructure.
The Technique Is Small but Operationally Significant
NullReceiver does not store a large payload.
It stores a compact C2 value.
That is enough to guide malware to the next stage.
Small pieces of hidden data can create major defensive challenges.
Attackers Are Reducing Their Exposure
Every fixed indicator creates a detection opportunity.
NullReceiver removes several fixed indicators.
There is no embedded C2 domain.
There is no required smart contract.
There is no non-empty calldata.
There is no permanent burn-address destination.
The attack surface for defenders becomes narrower.
The Most Valuable Detection Signal Is the Full Chain
One blockchain request may be benign.
One hexadecimal conversion may be benign.
One outbound connection may be benign.
The combination is highly unusual.
Correlation is the key.
Security tools should connect events across processes and time.
Developer Education Must Include Supply-Chain Threats
Technical teams should recognize malicious interview projects.
Recruitment-related repositories deserve careful review.
Unverified dependencies should not be installed blindly.
Coding assignments should be isolated.
Sensitive credentials should not be available inside test environments.
Sandboxing Can Limit Damage
Unknown packages should be tested in isolated environments.
Containers can reduce exposure.
Disposable virtual machines provide stronger separation.
Secrets should not be mounted into untrusted projects.
Production credentials should never be present during package evaluation.
npm Security Requires More Than Vulnerability Scanning
Known vulnerability scanners may not identify newly published malware.
A package can contain no known CVE.
Its code can still be malicious.
Organizations need provenance checks.
They need behavioral monitoring.
They need dependency governance.
Threat Intelligence Must Track Techniques, Not Only Indicators
IP addresses can change.
Domains can change.
Wallets can change.
Package names can change.
The technique may remain stable.
Detection programs should track the underlying behavior.
NullReceiver May Inspire Copycat Activity
The technique is relatively compact.
Its core idea is easy to understand.
Other threat groups may experiment with similar approaches.
Blockchain-based dead drops could appear outside DPRK activity.
Defenders should prepare for broader adoption.
The Defensive Response Should Be Proportional
Organizations should not block all blockchain services automatically.
That may disrupt legitimate work.
Instead, they should define approved usage.
Unexpected blockchain access should be reviewed.
High-risk systems may require stricter controls.
The Most Important Lesson Is Architectural
Attackers are no longer limited to malicious servers.
They can build operations on public platforms.
Cloud services can be abused.
Code repositories can be abused.
Social networks can be abused.
Blockchains can be abused.
Trust in infrastructure does not guarantee safe usage.
✅ Verified: NullReceiver Was Found in Trojanized npm Packages
The reported packages [email protected] and [email protected] were identified as malicious packages impersonating legitimate Tailwind CSS-related tools.
The campaign was associated with DPRK-linked Contagious Interview activity.
The use of developer-focused package ecosystems is consistent with the campaign’s broader targeting strategy.
✅ Verified: The C2 Information Was Hidden in an Ethereum Recipient Address
The technique did not rely on a smart contract or transaction calldata.
Instead, the recipient field of a zero-value transaction was used as a covert data container.
The encoded address was designed to provide malware with a C2 destination during runtime.
✅ Verified: The Observed Transaction Had No Value and an Empty Input Field
The transaction contained a zero value.
Its input field was recorded as 0x.
These characteristics reduce the visibility of malicious content during conventional blockchain inspection.
✅ Verified: NullReceiver Removes Several EtherHiding Detection Signals
NullReceiver avoids smart-contract interactions.
It does not place information in transaction calldata.
It also avoids relying on a permanent, widely recognized destination such as Ethereum’s burn address.
⚠️ Context Required: Blockchain Traffic Is Not Proof of Malware
Connections to Ethereum RPC services can be legitimate.
Blockchain developers, decentralized applications, and research tools may use the same infrastructure.
Detection should rely on behavioral context rather than the presence of blockchain traffic alone.
⚠️ Context Required: The C2 IP Address May Change
The observed IP address is an indicator connected to the analyzed activity.
Attackers can publish new transactions containing new encoded destinations.
Defenders should prioritize the decoding technique and behavioral chain rather than relying only on one IP address.
Prediction
(-1) Blockchain-Based C2 Techniques Will Become More Common
NullReceiver is likely to encourage further experimentation with blockchain-based malware infrastructure.
Threat actors may adopt recipient-address encoding, wallet rotation, multi-chain dead drops, or layered blockchain lookup mechanisms.
As defenders improve monitoring of Ethereum activity, attackers may move to other public networks or distribute C2 information across multiple transactions.
The negative prediction is that traditional domain and IP blocklists will become less effective against malware that retrieves infrastructure dynamically.
(+1) Behavioral Detection Will Improve Faster Than Static Detection
Security platforms are likely to develop stronger analytics for blockchain-aware malware behavior.
Future detections may correlate npm execution, Ethereum RPC requests, hexadecimal decoding, wallet activity, and outbound network connections.
Organizations that invest in endpoint telemetry, supply-chain monitoring, and behavioral analytics will be better positioned to detect techniques like NullReceiver.
The positive prediction is that the same public transparency that helps attackers publish hidden data may eventually help defenders map and track malicious infrastructure at scale.
Indicators of Compromise
Malicious npm Package
[email protected]
Trojanized package impersonating a Tailwind CSS-related plugin and associated with the DPRK-linked Contagious Interview campaign.
Malicious npm Package
[email protected]
Trojanized package identified as using the NullReceiver blockchain-based C2 technique.
Potential Code Signature
A10-npm3!
The string may be useful for hunting related malware code and should be evaluated alongside additional behavioral evidence.
Observed Ethereum RPC Services
1rpc.io
eth.drpc.org
These are legitimate public services and should not be treated as malicious solely because they appear in logs.
Observed Encoded Recipient Address
0xa658863ea658863e68656c6c6f6970626f742121
The address was used as a data container rather than a conventional financial destination.
Decoded C2 Address
166[.]88[.]134[.]62
The address is intentionally defanged to reduce accidental connections.
Observed Operator Marker
helloipbot!!
The trailing decoded string may provide an additional fingerprint for threat hunting and campaign correlation.
Conclusion: The Hidden Message Inside an Empty Transaction
A New Chapter in Blockchain-Powered Malware
NullReceiver demonstrates that malicious infrastructure no longer needs to be hosted on an obviously malicious server or embedded directly inside malware.
A zero-value Ethereum transaction can become a hidden instruction.
A recipient address can become a data container.
A public blockchain can become a resilient command-and-control dead drop.
The technique is technically simple, but its operational consequences are significant.
For defenders, the response cannot rely only on blocking known IP addresses or scanning code for suspicious domains. Security teams must understand how software behaves after execution, how public infrastructure can be repurposed, and how seemingly ordinary data fields can carry hidden meaning.
The lesson is clear: modern threats are increasingly built around trusted systems. The infrastructure may be legitimate. The transaction may be public. The code may resemble a useful developer package.
But beneath an empty Ethereum transaction, a malware operator may be hiding the next destination.
▶️ Related Video (82% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: cyberpress.org
Extra Source Hub (Possible Sources for article):
https://www.facebook.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
